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Abstract. One of the most promising and versatile approaches to creating 
new quantum algorithms is based on the quantum hidden subgroup (QHS) 
paradigm, originally suggested by Alexei Kitaev. This class of quantum al- 
gorithms encompasses the Deutsch-Jozsa, Simon, Shor algorithms, and many 
more. 

In this paper, our strategy for finding new quantum algorithms is to de- 
compose Shor's quantum factoring algorithm into its basic primitives, then to 
generalize these primitives, and finally to show how to reassemble them into 
new QHS algorithms. Taking an "alphabetic building blocks approach," we 
use these primitives to form an "algorithmic toolkit" for the creation of new 
quantum algorithms, such as wandering Shor algorithms, continuous Shor al- 
gorithms, the quantum circle algorithm, the dual Shor algorithm, a QHS al- 
gorithm for Feynman integrals, free QHS algorithms, and more. 

Toward the end of this paper, we show how Grover's algorithm is most 
surprisingly "almost" a QHS algorithm, and how this result suggests the pos- 
sibility of an even more complete "algorithmic tookit" beyond the QHS algo- 
rithms. 
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1. Introduction 

One major obstacle to the fulfillment of the promise of quantum computing is the 
current scarcity of quantum algorithms. Quantum computing researchers simply 
have not yet found enough quantum algorithms to determine whether or not future 
quantum computers will be general purpose or special purpose computing devices. 
As a result, much more research is crucially needed to determine the algorithmic 
limits of quantum computing. 

One of the most promising and versatile approaches to creating new quantum 
algorithms is based on the quantum hidden subgroup (QHS) paradigm, originally 
suggested by Alexei Kitaev (201 • This class of quantum algorithms encompasses 
the Deutsch-Jozsa, Simon, Shor algorithms, and many more. 

In this paper, our strategy for finding new quantum algorithms is to decompose 
Shor's quantum factoring algorithm into its basic primitives, then to generalize 
these primitives, and finally to show how to reassemble them into new QHS algo- 
rithms. Taking an "alphabetic building blocks approach," we will use these primi- 
tives to form an "algorithmic toolkit" for the creation of new quantum algorithms, 
such as wandering Shor algorithms, continuous Shor algorithms, the quantum circle 
algorithm, the dual Shor algorithm, a QHS algorithm for Feynman integrals, free 
QHS algorithms, and more. 

Toward the end of this paper, we show how Grover's algorithm is most surpris- 
ingly "almost" a QHS algorithm, and how this suggests the possibility of an even 
more complete "algorithmic tookit" beyond the QHS algorithms. 

2. An example of Shor's quantum factoring algorithm 

Before discussing how Shor's algorithm can be decomposed into its primitive 
components, let's take a quick look at an example of the execution of Shor's fac- 
toring algorithm. As we discuss this example, we suggest that the reader, as an 
exercise, try to find the basic QHS primitives that make up this algorithm. Can 
you see them? 

Shor's quantum factoring algorithm reduces the task of factoring a positive in- 
teger A to first finding a random integer a relatively prime to A, and then next to 
determining the period P of the following function 

Z ZmodA 
x i — ► a x mod N , 

where Z denotes the additive group of integers, and where ZmodA denotes the 
integers mod A under multiplication 1 . 



A random integer a with gcd (a, TV) = 1 is found by selecting a random integer, and then 
applying the Euclidean algorithm to determine whether or not it is relatively prime to TV. If not, 
then the gcd is a non-trivial factor of TV, and there is no need to proceed futher. However, this 
possibility is highly unlikely if TV is large. 
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Since Z is an infinite group, Shor chooses to work instead with the finite ad- 
ditive cyclic group Zq of order Q = 2 m , where N 2 < Q < 2N 2 , and with the 
"approximating" map 

Z Q ZmodTV 
x i — ► a 11 mod N , < x < Q 

Shor begins by constructing a quantum system with two quantum registers 

| Left_Register) |Right_Register) , 

the left intended for holding the arguments x of tp, the right for holding the corre- 
sponding values of yp. This quantum system has been constructed with a unitary 
transformation 

Uf.\x)\\)^\x)\<p(x)) 
implementing the "approximating" map p. 

As an example, let us use Shor's algorithm to factor the integer N = 21, assuming 
that a = 2 has been randomly chosen. Thus, Q — 2 9 = 512. 

Unknown to us, the period is P = 6, and hence, Q = 6 • 85 + 2. 

We proceed by executing the following steps: 



STEP Initialize 

m = io> ii> 



STEP 1 Apply the inverse Fourier transform 

511 



T- 1 : |«) ^^=Ylo- ux \x) 



512 „ 



to the left register, where u — exp(27ri/512) is a primitive 512-th root of 
unity, to obtain 



7 512 „ 



STEP 2 Apply the unitary transformation 

U$ : \x) |1) i — ► \x) |2 x mod21) 

to obtain 

|V> 2 > = -^=J2\x)\2* mod 21) 



Actually, for this step, the original Shor algorithm uses instead the Hadamard transform, 
which for step 1, has the same effect as the 512-point Fourier transform. 



STEP 3 
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Apply the Fourier transform 



511 

^ n 



to the left register to obtain 

511 511 



511 /511 



M*> = E E wBW if) i 2 " mod 21 > = m E iw> ( E ^ y i 2X mod 21 



ie=0 y=0 



512 



a =0 \a;=0 



^ Ely) It (2/)) 



y=0 



where 



511 



|T(y)) = ^^12* mod 21) 



z=0 



sTEP 4 I Measure the left register. Then with Probability 

T(y)\T(y)) 



Probq, (y) 



(512) 



the state will "collapse" to \y) with the value measured being the integer 
y, where < y < Q. 

A plot of Prob^p (y) is shown in Figure 1. (See |^] and [25] for details.) 



0.1 

Prob 

0.08 



[y = 85| [y = 



= 256 | 



|y = 341] [ y =427] 



JL 



y 



Figure 1. A plot of Prob^(y). 
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The peaks in the above plot of Prob^ (y) occur at the integers 

y = 0, 85, 171, 256, 341, 427. 

The probability that at least one of these six integers will occur is quite high. 
It is actually 0.78 + . Indeed, the probability distribution has been intentionally 
engineered to make the probability of these particular integers as high as possible. 
And there is a good reason for doing so. 

The above six integers are those for which the corresponding rational y/Q is 
"closest" to a rational of the form d/P. By "closest" we mean that 



y_ _ d_ 
Q P 



1 1 

< 2Q K 2P2 



In particular, 

85 171 256 341 427 
512' 512' 512 '512' 512' 512 
are rationals respectively "closest" to the rationals 

1 2 3 4 5 
6' 6' 6' 6' 6' 6 ' 

The six rational numbers 0/6, 1/6, ... , 5/6 are "closest" in the sense that they are 
convergents of the continued fraction expansions of 0/512, 85/512, ... , 427/512, 
respectively. Hence, each of the six rationals 0/6, 1/6, ... , 5/6 can be found 
using the standard continued fraction recursion formulas. 

But ... , we are not searching for rationals of the form d/P. Instead, we seek 
only the denominator P = 6. 

Unfortunately, the denominator P = 6 can only be obtained from the continued 
fraction recursion when the numerator and denominator of d/P are relatively prime. 
Given that the algorithm has selected one of the random integers 0, 85, ... , 427, 
the probability that the corresponding rational d/P has relatively prime numerator 
and denominator is 0(6) /6 = 1/3, where </>(—) denotes the Euler phi (toticnt) 
function. So the probability of finding P = 6 is actually not 0.78 + , but is instead 
0.23". 

As it turns out, if he repeats the algorithm O (lglg N) times, we will obtain the 
desired period P with probability bounded below by approximately 4/n 2 . However, 
this is not the end of the story. Once we have in our possession a candidate P' for 
the actual period P = 6, the only way we can be sure we have the correct period 
P is to test P' by computing 2 P mod 21. If the result is 1, we are certain we 
have found the correct period P. This last part of the computation is done by the 
repeated squaring algorithm 3 . 



3 By the repeated squaring algorithm, we mean the algorithm which computes a p mod N via 
the expression 

Hi-)'"- 

3 

where P ' = £V P'p? is the radix 2 expansion of P' . 
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3. Definition of quantum hidden subgroup (QHS) algorithms 

Now that we have taken a quick look at Shor's algorithm, let's see how it can 
be decomposed into its primitive algorithmic components. We will first need to 
answer the following question: 

What is a quantum hidden subgroup algorithm? 

But before we can answer the this question, we need to provide an answer to an 
even more fundamental question: 

What is a hidden subgroup problem? 

Definition 1. A map (p : G — > S from a group G into a set S is said to have 
hidden subgroup structure if there exists a subgroup K v of G, called a hidden 
subgroup, and an injection l v : G/K v — > S, called a hidden injection, such 
that the diagram 

G S 
G/K v 

is commutative 4 , where G / K v denotes the collection of right cosets of K v in G, 
and where v : G — ► G/K v is the natural surjection of G onto G/K v . We refer 
to the group G as the ambient group and to the set S as the target set. If 
K v is a normal subgroup of G, then H v = G/K v is a group, called the hidden 
quotient group, and v : G — ► G/K v is an epimorphism, called the hidden 
epimorphism. We will call the above diagram the hidden subgroup structure 
of the map tp : G — > S. (See \M>fM-) 

Remark 1. The underlying intuition motivating this formal definition is as follows: 
Given a natural surjection (or epimorphism) v : G — ► G/K v , an "archvillain with 
malice of forethought" hides the algebraic structure of v by intentionally renaming 
all the elements of G/K v , and "maliciously tossing in for good measure" some 
extra elements to form a set S and a map ip : G — ► S. 

The hidden subgroup problem can be stated as follows: 

Hidden Subgroup Problem (HSP). Let tp : G — ► S be a map with hidden 
subgroup structure. The problem of determining a hidden subgroup K v of G is 
called a hidden subgroup problem (HSP). An algorithm solving this problem 
is called a hidden subgroup algorithm. 

The corresponding quantum form of this HSP is stated as follows: 

Hidden Subgroup Problem (Quantum Version). Let ip : G — ► S be a map 

with hidden subgroup structure. Construct a quantum implementation of the map 
ip as follows: 

By saying that this diagram is commutative, we mean ip = i v o v. The notion generalizes in 
an obvious way to more complicated diagrams. 
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Let Tie and Tis be Hilbert spaces defined respectively by the orthonormal bases 
{\g) : 5 e G}and {\s) : s G S} and let sq = ip (1), where 1 denotes the identity 5 of 
the ambient group A. Finally, let U v be a unitary transformation such that 

n G ®n s — ► n G <g> H s 

Iff) l s o> i-> \g) \ip(g)} 

Determine the hidden subgroup K v with bounded probability of error by making 
as few queries as possible to the blackbox U v . A quantum algorithm solving this 
problem is called a quantum hidden subgroup ( QHS) algorithm. 



4. The generic QHS algorithm 

We are now in a position to construct one of the fundamental algorithmic prim- 
itives found in Shor's algorithm. 

Let if : G — ► S be a map from a group G to a set S with hidden subgroup 
structure. We assume that all representations of G are equivalent to unitary rep- 
resentations 6 . Let G denote a complete set of distinct irreducible unitary 
representations of G. Using multiplicative notation for G, we let 1 denote the 
identity of G, and let so denote its image in S. Finally, let 1 denote the trivial 
representation of G. 

Remark 2. If G is abelian, then G becomes the dual group of characters. 

The generic QHS algorithm is given below: 

Quantum Subroutine QRand(</?) 

Step 0. Initialization 



|Vo) = 1) |*o> e Hq ® H s 
Step 1. Application of the inverse Fourier transform ^ r G " 1 of G to the left register 

where \G\ denotes the cardinality of the group G. 
Step 2. Application of the unitary transformation U v 

IVJ2> = -mYi^Wis)) ^n G ®n s 



'We are using multiplicative notation for the group G. 

'This is true for all finite groups as well as for a large class of infinite groups. 
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Step 3. Application of the Fourier transform Tq of G to the left register 

1^} = iiEW Trace E ^ (9) |7> Hd)) = 7^ E N Trace (It> W)» e w g® w « 



where I7I denotes the degree of the representation 7, where 7^ denotes 
at repn 

|7| |7| 



the contragradient representation (i.e., 7^ (g) = 7 (g^ 1 ) = 7(3) ), where 



Trace (7+ | 7 )) = EE 7ji (s) l7y>. and where $ (7],)) = E 7j» (sO |<P (s))- 
i=lj=l v // geG 

Step 4. Measurement of the left quantum register with respect to the orthonormal 
basis 

{|7ii>:7eG,l<i,j<|7|} • 
Thus, with probability 

Prob v (7y) = X ^2 V " 

the resulting measured value is the entry 7y, and the quantum system 
"collapses" to the state 



Step 5. Step 5. Output 7^, and stop. 



5. Pushing and Lifting hidden subgroup problems (HSPs) 



But Shor's algorithm consists of more than the primitive QRand. 

For many (but not all) hidden subgroup problems (HSPs) ip : G — ► 5, the cor- 
responding generic QHS algorithm QRand either is not physically implemcntablc 
or is too expensive to implement physically. For example, the HSP ip is usually 
not physically implcmentable if the ambient group is infinite (e.g., G is the infinite 
cyclic group Z) , and is too expensive to implement if the ambient group is too large 
(e.g., G is the symmetric group §10100). In this case, there is a standard generic 
way of "tweaking" the HSP to get around this problem, which we will call pushing. 



Definition 2. Let ip : G — ► S be a map from a group G to a set S. A map 

<p : G — ► S from a group G to the set S is said to be a push of p, written 

p = Push (<p) , 
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provided there exists an epimorphism v : G — ► G from G onto G, and a transversal 
t : G — ► G of v such that tp = tp o t, i.e., such that the following diagram is 
commutative 

G S 
Tr 
G 



If the epimorphism \i and the transversal r are chosen in an appropriate way, 
then execution of the generic QHS subroutine with input tp — Push(tp) , i.e., 
execution of 

QRand (tp) , 

will with high probability produce an irreducible representation 7 of the group G 
which is sufficiently close to an irreducible representation 7 of the group G. If this 
is the case, then there is a polynomial time classical algorithm which upon input 7 
produces the representation 7. 



Obviously, much more can be said about pushing. But unfortunately that 
would take us far afield from the objectives of this paper. For more information 
on pushing, we refer the reader to |27| . 



It would be amiss not to mention that the above algorithmic primitive of pushing 
suggests the definition of a second primitive which we will call lifting. 



Definition 3. Let tp : G — ► S be a map from a group G to a set S. A map 

ip: G — ► S from a group G to the set S is said to be a lift of tp, written 

<p = Lift (tp) , 

provided there exists an morphism n : G — ► G from G to G such that tp = tp o n, 
i.e., such that the following diagram is commutative 

G 

V I \£ 
G -2+ S 



'Let v : A > B be an epimorphism from a group A to a group B. Then a transversal 

t of v is is a map r : B > A such that u o r : B > A is the identity map b 1 — > b. (It 

immediately follows that r is an injection.) In othere words, a transversal r of an epimorphism 
v is a map which maps eacl element b of B to an element of A contained in the coset b, i.e., to a 
coset representative of b. 
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Two Ways to Create New Quantum Algorithms 
Pushing and Lifting 




Figure 2. Pushing and Lifting HSPs. 



6. SHOR'S ALGORITHM REVISITED 

We are now in position to describe Shor's algorithm in terms of its primitive 
components. In particular, we are now in a position to see that Shor's factoring 
algorithm is a classic example of a QHS algorithm created from the push of an HSP. 

Let N be the integer to be factored. Let Z denote the additive group of integers, 
and Z^r denote the integers mod A" under multiplication. 

Shor's algorithm is a QHS algorithm that solves the following HSP 

ip : Z — ► Z^ 
m i — ► a m mod N 

with unknown hidden subgroup structure given by the following commutative dia- 
gram 

Z ^ ^ N 

Z/PZ 

where a is an integer relatively prime to N, where P is the hidden integer period of 
the map <p : Z — ► Z^ , where PZ is the additive subgroup of all integer multiples 
of P (i.e., the hidden subgroup), where v : Z — > Z/PZ is the natural epimorpism 
of the integers onto the quotient group Z/PZ (i.e., the hidden epimorphism) , and 
where i : Z/PZ — > Z^r is the hidden monomorphism. 

An obstacle to creating a physically implementable algorithm for this HSP is 
that the domain Z of ip is infinite. As observed by Shor, a way to work around 
this difficulty is to push the HSP. 
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In particular, as illustrated by the following commutative diagram 

Z Z* 

\l \\ T / Cf = Push (f) — if O T , 

a push tp = Push (if) is constructed by selecting the epimorphism fi : Z — ► Zq of 
Z onto the finite cyclic group Zq of order Q, where the integer Q is the unique 
power of 2 such that N 2 < Q < 2N 2 , and then choosing the transversal 8 

t : Z Q — Z 
to mod Q i — ► to ' 

where < to < Q. This push tp = Push (if) is called Shor's oracle. 

Shor's algorithm consists in first executing the quantum subroutine QRand(£>), 
thereby producing a random character 

Jy/Q ■ to mod Q i — ► — — mod 1 

of the finite cyclic group Zq. The transversal r used in pushing has been engineered 
in such a way as to assure that the character 7 y /Q is sufficiently close to a character 

kd 

Jd/P '■ * mod P i — ► — mod 1 

of the hidden quotient group Z/PZ = Zp. In this case "sufficiently close" means 
that 



1 



y_ _ d_ 
Q P 

which means that d/P is a continued fraction convergent of y/Q, and thus can be 
found found by the classical polynomial time continued fraction algorithm 9 . 



7. Wandering Shor algorithms, a.k.a., vintage Shor algorithms. 



Now let's use the primitives described in sections 3, 4, and 5 to create other new 
QHS algorithms, called wandering Shor algorithms. 

Wandering Shor algorithms are essentially QHS algorithms on free abelian fi- 
nite rank n groups A which, with each iteration, first select a random cyclic direct 
summand Z of the group A, and then apply one iteration of the standard Shor algo- 
rithm to produce a random character of the "approximating" finite group A = Zq, 
called a group probe 10 . Three different wandering Shor algorithms are created in 
|25j . The first two wandering Shor algorithms given in are quantum algorithms 
which find the order P of a maximal cyclic subgroup of the hidden quotient group 
H v . The third computes the entire hidden quotient group H v . 

®A transversal for an epimorphism a v : Z > Zq is an injection r v : > TL such that 

dip o t v is the identity map on Zq, i.e., a map that takes each element of Zq onto a coset 
representative of the element in Z . 

9 The characters 7 h /q and Jd/P can m the obvious way be identified with points of in the unit 
circle in the complex plane. With this identification, we can see that this inequalty is equivalent 
to saying the the chordal distance bewteen these two rational points on the unit circle is less than 
or equan to 1/2P 2 . Hence, Shor's algorithm is using the topology of the unit circle. 

10 By a group probe A, we mean an epimorphic image of the ambient group A. 
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The first step in creating a wandering Shor algorithm is to find the right gener- 
alization one of the primitives found in Shor's algorithm, namely, the transversal 
i : Zq — > Z of Shor's factoring algorithm. In other words, we need to construct 
the "correct" generalization of the transversal from Zq to a free abelian group A 
of rank n. For this reason, we have created the following definition: 



Definition 4. Let A be the free abelian group of rank n, let v : A — > Zq onto the 
cyclic group Zq of order Q with selected generator a. A transversal 11 l : Zq — > A 
of v is said to be a Shor transversal provided that: 

1) l (no) = m (a) for all < n < Q 

2) For each (free abelian) basis a[, a' 2 , ■ ■ . , a' n of A, the coefficients A^, A' 2 , . . . , \' Tl 
of t (a) = A X satisfy gcd (Ai, . . . , \' n ) = 1. 



Remark 3. Later, when we construct a generalization of Shor transversals to free 
groups of finite rank n, we will see that the first condition simply states that a 
Shor transversal is nothing more than a 2-sided Schreier transversal. The second 
condition of the above definition simply says that I maps the generator a of Zq 
onto a generator of a free direct summand Z of A. (For more details, please refer 
to section 12 of this paper.) 



Remark 4. In |25) . we show how to use the extended Euclidean algorithm to con- 
struct the epimorphism v : A — ► Zq and the transversal i : Zq — ► A. 



Let v : A > B be an epimorphism from a group A to a group B. Then a transversal 

r of v is is a map r : B > A such that v o r : B > A is the identity map b i — > b. (It 

immediately follows that r is an injection.) In othere words, a transversal r of an epimorphism 
v is a map which maps eacl element b of B to an element of A contained in the coset b, i.e., to a 
coset representative of b. 
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Vintage_Shor( <p , Q, n) 

<Sp> 




Select basis t a j } of A & gen. a of 










Lj£ = Ran_Shor_Transv({a'.}, Q , a, n ) 



X ,„ = QRand ~ ( ) 

y/Q 

I - 





[(d-,p"),(d',p')] =[(o,i),d,Ly / Qj)] 
















[(d",P"), (d'J 5 ')] = Next_CFC[(d'\P"), (d',P')] 



^)(PV.)=^(s n ) Vj 



[no 






YES 






Output P' 



NO 



YES 



(Stog) 



Figure 3. Flowchart for the first wandering Shor algorithm (a.k.a., a 
vintage Shor algorithm). This algorithm finds the order P of a 
maximal cyclic subgroup of the hidden quotient group H v . 



Flow charts for the three wandering Shor algorithms created in |25| are given in 
figures 3 through 5. In [25] . these were also called vintage Shor algorithms. 
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Altl_Vintage_Shor( <p, Q, n, K) 



Select basis i a j I of A & gen. a of 



Iter = 

zzi — 



tj^ = Ran_Shor_Transv({a'. }, Q , a, n ) 



J 



H 



X = QRand ~ ( ) 
y/Q ^ 



Kd",p»), (d',p-)] = [(o,d, d,Ly /Q J )i 



[(d",P"), (d',P')] =Next_CFC[(d",P"), (d',P')] 



|P = lcm(P, "F) 




YES 



£>(Pa\) = <£>(s ) Vj 



YES 



(Stop!) 1 Output P 



Figure 4. Flowchart for the second wandering Shor algorithm (a.k.a., a 
vintage Shor algorithm). This algorithm finds the order P of a 
maximal cyclic subgroup of the hidden quotient group H v . 
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Alt2 Vintage_Shor( <p , Q, n , K) 

I 



& #NonZeroRows = & Iter = 



Select basis i a j < of A »& gen. a of Z^ 



T 



= Ran_Shor_Transv({a'.}, Q , a, n ) 



X „ = QRand „ ( ) 
y/Q <p 



[(d" 



,p"), (d',p-)] = [(o,d, (i,L y/Q J >] 



|[(d",P"), (d',P')] =Next_CFC[(d",P"), (d',P')] 




Q, = Echelon_Canonical( Q ) 



#NonZeroRows = NumNonZeroRows( Q ) 



Iter = Iter + 1 



Iter = K 

NO OR YES 

#NonZeroRows 



output Q, _(storj) 



Figure 5. Flowchart for the third wandering Shor algorithm, a.k.a., 
vintage Shor algorithm. This algorithm finds the entire hidden 

quotient group H v . 
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The algorithmic complexities of the above wandering Shor algorithms is given in 
|25j . For example, the first wandering Shor algorithm is of time complexity 

0(n 2 (lgiV) 3 (lglgiVr +1 ) , 

where n is the rank of the free abelian group A. This can be readily deduced from 
the abbreviated flowchart given in figure 6. 



Stepl O(n) 




Figure 6. Abbreviated flowchart for the first wandering Shor algorithm. 



8. Continuous (variable) Shor algorithms 

In in and in (2H|, the algorithmic primitives found in above sections of this 
paper were used to create a class of algorithms called continuous Shor algorithms. 
By a continuous variable Shor algorithm, we mean a quantum hidden subgroup 
algorithm that finds the hidden period P of an admissible function ip : K — > K 
from the reals R to itself. 



QHS ALGORITHMS 



17 



Remark 5. By an admissible function, we mean a function belonging to any suf- 
ficiently well behaved class of functions. For example, the class of functions which 
are Lebesgue integrable on every closed interval o/R. There, are many other classes 
of functions that work equally as well. 



Actually, the papers [27], |2H] give in succession three such continuous Shor 
algorithms, each successively more general than the previous. 

For the first algorithm, we assume that the unknown hidden period P is an 
integer. The algorithm is then constructed by using rigged Hilbert spaces 0], 
linear combinations of Dirac delta functions, and a subtle extension of the 
Fourier transform found in the generic QHS subroutine QRand^), which has 
been described previously in section 4 of this paper. In Step 5 of QRand^), the 
observable 



is measured, where Q is an integer chosen so that Q > 2P 2 . It then follows that the 
output of this algorithm is a rational m/Q which is a convergent of the continued 
fraction expansion of a rational of the form n/P. 

The above quantum algorithm is then extended to a second quantum algorithm 
that finds the hidden period P of functions (p : R — > R, where the unknown period 
P is a rational. 

Finally, the second algorithm is extended to a third algorithm which finds the 
hidden period P of functions tp : R — ► R, when P is an arbitrary real number. We 
point out that for the third and last algorithm to work, we must impose a very 
restrictive condition on the map tp : R — > R, i.e., the condition that the map tp is 
continuous. 



9. The quantum circle and the dual Shor algorithms. 



We have shown in previous sections how the mathematical primitives of pushing 
and lifting can be used to create new quantum algorithms. In particular, we have 
described how pushing and lifting can be used to derive new HSPs from an HSP 
tp : G — ► S on an arbitrary group G. We now see how group duality can be 
exploited by these two primitives to create even more quantum algorithms. 




— oo 
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Another Way to Create New Quantum Algorithms 
Duality 




Figure 7. Using duality to create new QHS algorithms. 



To this end, we assume that G is an abelian group. Hence, its dual group of 
characters G exists 12 . It now follows that pushing and lifting can also be used to 
derive new HSPs from an arbitrary HSP $ : G — > S' on the dual group G. In 
|27j . this method is used to create a number of new quantum algorithms derived 
from Shor-like HSPs ip : Z — ► S. 

A roadmap is shown in figure 8 of the developmental steps taken to find and to 
create a new QHS algorithm on Zq, which is (in the sense described below) dual 
to Shor's original algorithm. We call the algorithm developed in the final step of 
figure 8 the dual Shor algorithm. 



Lifting & Duality 



QHS Algorithm Based 
on Shor HSP 




Figure 8. Roadmap for creating the dual Shor algorithm. 



If G is non-abelian, then its dual is not a group, but instead the representation algebra A 
over the group ring CG. The methods described in this section can also be used to create new 
quantum algorithms for HSPs $ : A > S on on the representation algebra A. 
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As indicated in figure 5, our first step is to create an intermediate QHS algo- 
rithm based on a Shor-like HSP (p : Z — ► S from the additive group of integers Z 
to a target set S. The resulting algorithm "lives" in the infinite dimensional space 
defined by the orthonormal basis {(n\ : n G Z}. This is a physically unem- 
plementable quantum algorithm created as a first steping stone in our algorithmic 
development sequence. Intuitively, this algorithm can be viewed as a "distillation" 
or a "purification" of Shor's original algorithm. 

As a next step, duality is used to create the quantum circle algorithm. 

This is accomplished by devising a QHS algorithm for an HSP $ : R/Z — > S on 
the dual group R/Z of the additive group of integers Z. (By R/Z, we mean the 
additive group of reals modi, which is isomorphic to the multiplicative group 
{e 2 : < 9 < l}, i.e., the unit circle in the complex plane.) Once again, this 
is probably a physcally unemplementable quantum algorithm 13 . But its utility 
lies in the fact that it leads to the physically implcmentable quantum algorithm 
created in the last and final developmental step, as indicated in figure 8. For in 
the final step, a physically implementable QHS algorithm is created by lifting the 
HSP $ : M/Z — ► S to an HSP $ : Z Q — ► S. For the obvious reason, we call the 
resulting algorithm a dual Shor algorithm. 

For detailed descriptions of each of these quantum algorithms, i.e., the "distilled" 
Shor, the quantum circle, and the dual Shor algorithms, the reader is referred to 
EH and [23. 

We give below brief descriptions of the quantum circle and the dual Shor algo- 
rithms. 

For the quantum circle algorithm, we make use of the following spaces (each 
of which is used in quantum optics): 

• The rigged Hilbert space .Hr/z with orthonormal basis {\x) : x € R/Z}. 
By "orthonormal" we mean that (x\y) = 5 (x — y), where " 8" denotes the 
Dirac delta function. The elements of .Hr/z are formal integrals of the 
form <f dx f{x) \x). (The physicist Dirac in his classic book[S[ on quantum 
mechanics refers to these integrals as infinite sums. See also 0] and \W\.) 

• The complex vector space H% of formal sums 

< ^ a n |n> : a n £ C Vn E Z \ 

\n— — oo ) 

with orthonormal basis {\n) : n € Z}. By "orthonormal" we mean that 
(n\m) = 8 nm , where S nm denotes the Kronecker delta. 

We can now design an algorithm which solves the following hidden subgroup 
problem: 

Hidden Subgroup Problem for the Circle. Let <i> : R/Z — ► C be an ad- 
missible function from the circle group R/Z to the complex numbers C with hidden 



There is a possibility that the quantum circle algorithm may have a physical implementation 
in terms of quantum optics. 
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rational period a £ Q/Z, where a <E Q/Z denotes the rational circle, i.e., the 
rationals mod 1 . 

Remark 6. By an admissible function, we mean a function belonging to any suf- 
ficiently well behaved class of functions. For example, the class of functions which 
are Lebesgue integrable on R/Z. There, are many other classes of functions that 
work equally as well. 

Proposition 1. If a = ai/a 2 (with gcd(ai,a 2 ) = 1) is a rational period of a 
function $ : R/Z — ► C, then l/a 2 is also a period of $. Hence, the minimal 
rational period of $ is always a reciprocal integer mod 1 . 

The following quantum algorithm finds the reciprocal integer period of the func- 
tion <I>. 



Step 2. Step 2. Application of the unitary transformation U v : \x) \u) i— > \x) \u + &(x)) 



Circle- Algorithm (<&) 



Step 0. Initialization 



|Vo) = |0) |0) e H z ® H c 



Step 1. Application of the inverse Fourier transform T 1 <£> 1 





Step 3. Application of the Fourier transform T <£> 1 



Remark 7. Remark. Letting have 



a 




m/a 





^ ^ g-27rmm/i 
m=0 



a 




QHS ALGORITHMS 



21 



where 1/a is the unknown reciprocal period. But 



a — 1 , 
^ e -2imm/a _ a <5 n=0moda = J 



if n — mod a 
otherwise 



m=0 

Hence, 

l/a 

1-03} = £ |n> / dX e " 2 " ma; I* (*)> = ( E l"> *n=Omoda / e" 2 ™* |$ (*)> 

E i £a >) i / ^ e ~ 2,Hnx i $ (*)> I = E i n ( fo )> 



\iez 



Step 4. Measurement of 

with respect to the observable 

E n ' n ) < n i 

to produce a random eigenvalue la. 

Remark 8. The above quantum circle algorithm can be extended to a quantum 
algorithm which finds the hidden period a of a function $ : R/Z — ► C, when a is 
an arbitrary real number mod 1 . But in creating this extended quantum algorithm, 
a very restrictive condition must be imposed on the map $ : R/Z — ► C, namely, 
the condition that $ be continuous. 

We now give a brief description of the dual Shor algorithm. 

The dual Shor algorithm is a QHS algorithm created by making a discrete ap- 
proximation of the quantum circle algorithm. More specifically, it is created by 
lifting the QHS circle algorithm for ip : R/Z — ► C to the finite cyclic group Zq, as 
illustrated in the commutative diagram given below: 

A* I \f = Push (ip) = ip o fj, 
— ► S 



Intuitively, just as in Shor's algorithm, the circle group R/Z is "approximated" 
with the finite cyclic group 1q , where the group Zq is identified with the additive 
group 

1 Q-l\ 
and where the hidden subgroup Zp is identified with the additive group 
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with P = a<2- 

This is a physically implementable quantum algorithm. In a certain sense, it is 
actually faster than Shor's algorithm. For the last step of Shor's algorithm uses the 
standard continued fraction algorithm to determine the unknown period. On the 
other hand, the last step of the dual Shor algorithm uses the much faster Euclidean 
algorithm to compute the greatest common divisor of the integers £±a, £2(1, 13a, . . ., 
thereby determining the desired reciprocal integer period 1/a. For more details, 
please refer to and 



We now discuss a QHS algorithm based on Feynman path integrals. This 
quantum algorithm was developed at the Mathematical Sciences Research Institute 
(MSRI) in Berkeley, California when one of the authors of this paper was challenged 
with an invitation to give a talk on the relation between Feynmann path integrals 
and quantum computing at an MSRI conference on Feynman path integrals. 

Until recently, both authors of this paper thought that the quantum algorithm to 
be described below was a highly speculative quantum algorithm. For the existence 
of Feynman path integrals is very difficult (if not impossible) to determine in a 
mathematically rigorous fashion. But surprisingly, Jeremy Becnel in his doctoral 
dissertation £Q actually succeeded in creating a firm mathematical foundation for 
this algorithm. 

We should mention, however, that the physical implementability of this algo- 
rithm is still yet to be determined. 

Definition 5. Definition. Let Paths be the real vector space of all continuous 
paths x : [0,1] — ► R n which are L 2 with respect to the inner product 



with scalar multiplication and vector sum defined as 

• (Xx) (s) = Ax (s) 

• (x + y) (s) = x(s)+y (s) 

We wish to create a QHS algorithm for the following hidden subgroup problem: 

Hidden Subgroup Problem for Paths. Let <p : Paths — > C be a functional 
with a hidden subspace V of Paths such that 

tp (x + v) = if (x) \fv € V 

Our objective is to create a QHS algorithm which solves the above problem, i.e., 
which finds the hidden subspace V. 



10. A QHS algorithm for Feynman integrals. 



x ■ y = / ds x(s)y(s) 
Jo 




Definition 6. Let Hp ATHS be the rigged Hilbert space with orthonormal basis {\x) : x € Paths}, 
and with bracket product (x\y) = 6 (x — y). 
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We will use the following observation to create the QHS algorithm: 

Observation. Paths = [J (v + V 1 -), where V 1 - denotes the orthogonal com- 
plement of the hidden vector subspace V. 

The QHS algorithm for Feynman path integral is given below: 

Feynman(^) 

Step 0. Initialize 

Wo) = \0)\0)eH Patha ®Hc 

Step 1. Apply T~ x <g> 1 

= J Vx e 2m0 \x) |0> = J Vx \x) |0) 

Paths Paths 

Step 2. Apply U v : \x) \u) ^ \x) \u + ip(x)) 

|V> 2 ) = j Vx \x) \y{x)) 

Paths 

Step 3. Apply T <g> 1 

IVs) - J Vy J Vx e- 2 ™-y\y)\ V (x)) 
Paths Paths 
= J Vy \y) j Vx e - 2mx -y \tp(x)) 
Paths Paths 

But 

J Vx e~ 2nix - y \<p(x)) = Jvv J Vx e - 2mx -y \<p(x)) 

Paths V v+V 1 - 

= jvvjvx e -2^(v+x)-y |^ ( v + x y 



V V-L 



V 1 

However, 



y Pi; e- 2 ™^ = jvu5(y- u) 

V V 1 - 
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So, 



-- J Vy \y) jvv e- 2lTlv - y jvx e- 2mx - v \<p(x)) 
Paths™ V V 1 - 

-- J Vy \y) jvu5{y-u) jvxe- 2 ™-y\<p{x)) 

Paths„ v-l v-l 

= fpu |u) / Vx e- 2mx - u \ip (x)) 



J Vu \u) \Cl(u)) 



Step 4. Measure 

|Vs) = /©u |«>|fi(«)> 

with respect to the observable 

A = J Vw \w) (w\ 

Paths 

to produce a random element of V 1 - 

The above algorithm suggests an intriguing question. Can the above QHS Feyn- 
man integral algorithm be modified in such a way as to create a quantum algorithm 
for the Jones polynomial? In other words, can it be modified by replacing Paths 
with the space of gauge connections, and making suitable modifications? 

This question is motivated by the fact that the integral over gauge transforma- 
tions 

$(K) = J VA ip (A) Wk (A) 
looks very much like a Fourier transform, where 



W K {A) = tr (^Pexp A 
denotes the Wilson loop over the knot K. 

11. QHS ALGORITHMS ON FREE GROUPS 

In this and the following section of this paper, our objective is to show that a 
free group is the the most natural domain for QHS algorithms. In retrospect, this 
is not so surprising if one takes a discerning look at Shor's factoring algorithm. For 
in section 6, we have seen that Shor's algorithm is essentially a QHS algorithm on 
the free group Z which has been pushed onto the finite group Zq. 

In particular, let ip : G — > S be a map with hidden subgroup structure from a 
finitely generated (f.g.) group G to a set S. We assume that the hidden subgroup 
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K is a normal subgroup of G of finite index. Then the objectives of this section 
are to demonstrate the following: 

• Every hidden subgroup problem (HSP) (p : G > S on an arbitray f.g. 

group G can be lifted to an HSP <p : F — ► S on a free group F of finite 
rank. 

• Moreover, a solution for the lifted HSP <p : F — ► S is for all practical 
purposes the same as the solution for the original HSP ip : G — > S. 

Thus, one need only investigate QHS algorithms for free groups of finite rank! 

Before we can describe the above results, we need to review a number of defini- 
tions. We begin with the definition of a free group: 

Definition 7 (Universal Definition). A group F is said to be free of finite rank n 
if there exists a finite set of n generators X — {x\,x 2 , ■ ■ ■ ,x n } such that, for every 
group G and for every map f : X — ► G of the set X into the group G, the map f 
extends to a morphism f : F — ► G. We call the set X a free basis of the group 
F, and frequently denote the group F by F (x\,x 2 , ■ ■ ■ ,x n ), . It follows from this 
definition that the morphism f is unique. 

The intuitive idea encapsulated by this definition is that a free group is an 
unconstrained group (very much analogous to a physical system without boundary 
conditions.) In other words, a group is free provided it has a set of generators 
such that the only relations among those generators are those required for F to be 
a group. For example, 

• x,- L x~ x = 1 is an allowed relation 

• XiXj — XjXi is not an allowed relation for i ^ j 

• xf = 1 is not an allowed relation 

As an immediate consequence of the above definition, we have the following 
proposition: 

Proposition 2. Let G be an arbitrary f.g. group with finite set of n generators 
{gi,g2, ■ ■ ■ ,gn}, and let F = F (xi, x 2 , . ■ . , x n ) be the free group of rank n with free 
basis {xi,X2, ■ ■ ■ ,x n }. 

Then by the above definition, the map Xj i — ► gj (j = 1, 2, . . . , n) induces a 
uniques epimorphism v : F — ► G from F onto G. With this epimorphism, every 
HSP <p : G — ► S on the group G uniquely lifts to the HSP Hp = ip o v : F — ► S on 
the free group F. 

Moreover, if K and K are the hidden subgroups of the HSPs ip and p, respec- 
tively, the corresponding hidden quotient groups G/K and F/K of these two HSPs 
are isomorphic. Hence, every solution of the HSP <p : F ► S immediately pro- 
duces a solution of the original HSP ip : G ► S. 

We close this section with the defintion of a group resentation, a concept that 
will be needed in the next section for generalizing Shor's algorithm to free groups. 
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Definition 8. Let G be a group. A group presentation 

(x lt x 2 , ...,x n :r 1 ,r 2 ,.- ■ ,r m ) 

for G is a set of free generators X\, x 2 , ■ ■ ■ , x n of a free group F and a set of 
words ri,r 2 , . . . ,r n in F (xi,x 2 , . . . ,x n ), called relators, such that the group G 
is isomorphic to the quotient group F (xi,x 2 , . . . , x n ) /Cons (r^,r 2 , . . . , r n ), where 
Cons (ri,r 2 , . . . , r n ), called the consequence of n, r 2 , . . . , r n , is the smallest nor- 
mal subgroup of F (xi, x 2 , . . . , x n ) containing the relators n, r 2 , . . . , r n . 

The intuition captured by the above definition is that x\,x 2 , . . . ,x n are the 
generators of G, and n = 1, r 2 = 1, . . . , r n = 1 is a complete set of relations among 
these generators, i.e., every relation among the generators of G is a consequence 
of (derivable from) the relations r\ = l,r 2 = 1, . . . , r n = 1. For example, 

• (xi,x 2 , ■ ■ ■ , x n :) and (x\, x 2 , ■ ■ ■ , x n : xix± , x^x^ 5 , x^X4X^ 1 x^ 1 ) are both 
presentations of the free group F (xi, x 2 , . . . ,x n ) 

• (x : x Q ) and (x : x a ,x b ) are both presentations of the cyclic group Zgof 
order Q, where a and b are integers such that gcd (a, b) = Q. 

• ^xi,x 2 : xf , x 2 , (xix 2 ) 2 ^ is a presentation of the symmetric group S3 on 
three symbols. 

12. Generalizing Shor's algorithm to free groups 

The objective of this section is to generalize Shor's algorithm to free groups of 
finite rank 14 . The chief obstacle to accomplishing this goal is finding a correct 
generalization of the Shor transversal 

n mod Q 1 — > n ( < n < Q) 

Unfortunately, there appear to be few mathematical clues indicating how to go 
about making such a generalization. However, as we shall see, the generalization 
of the Shor transversal to the transversal found in the wandering Shor algorithm 
does provide a crucial clue, suggesting that a generalized Shor transversal must be 
a 2-sided Schreier transversal. (See section 7.) 

We begin by formulating a constructive approach to free groups: 

Definition 9. Let F (xi, x 2l . . . , x„) be a free group with free basis xi, x 2 , . . . , x n . 
Then a word is a finite string of the symbols Xi, x7/ , x 2 , x 2 , . . . , i„, x~ x . A 
reduced word is a word in which there is no substring of the form xjxj 1 or xJ 1 Xj . 
Two words are said to be equivalent if one can be transformed into the other by 
applying a finite number of substring insertions or deletions of the form xjxj 1 or 
xj x xj . We denote an arbitrary word w by w — a\a 2 ■ ■ ■ an , where each aj = x^ 1 . 

14 We remind the reader that, in section 6, we showed that Shor's algorithm is essentially a 
QHS algorithm on the free group Z of rank 1 constructed by a push onto the cyclic group Zq. 
In light of this and of the results outlined in the previous section, it is a natural objective to 
generalize Shor's algorithm to free groups of finite rank. 
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The length \w\ of a word w — a\02 ■ ■ ■ ae is number of symbols x^ 1 that appear in 
w, i.e., \w\ = I. 

For example, xix~^ 1 x\x^ 1 x^ 1 ~x§ 1 x^ 1 x$ is a word of length 8 which is equivalent 
to the reduced word X^X-y x ^ x^ of length 4. 

It easily follows that: 

Proposition 3. A free group F (x\, x%, ■ ■ ■ , x n ) is simply the set of reduced words 
together with the obvious definition of product, i.e., concatenation followed by full 
reduction. 

We can now use this constructive approach to create a special kind of transversal 
r : G — ► F of an epimorphism v : F — ► G, called a 2-sided Scheier transversal jT^: 

Definition 10. A set W of reduced words in a free group F = F (x\,X2, ■ ■ ■ , x n ) 
is said to be a 2-sided Schreier system provided 

• The empty word 1 lies in W. 

• w = ai<22 • ■ ■ ai^iae £ W =>■ WLeft = ^1^2 ■ • • a>i-i G W, and 

• w = aia 2 ■ ■ ■ ai-ia e e W => w Right = a<z ■ ■ ■ a e _ia e e W 

Given an epimorphism v : F — > G of the free group F onto a group G, a 2-sided 
Schreier transversal t : G — ► F for v is a transversal of v for which there exists 
a 2-sided Schreier system such that t (G) = W. A 2-sided Schreier transversal is 
said to be minimal provided the length of each word w is less than or equal to 
the length of each reduced word in the coset wKer (u) — Ker (v) w, where Ker (y) 
denotes the kernel of the epimorpism v. 

The wandering Shor algorithm found in section 7 suggests that a correct gener- 
alization of the Shor transversal n mod N i — ► n (0 < n < Q) must at least have 
the property that it is a minimal 2-sided Schreier transversal. Whatetever other 
additional properties this generalization must have is simply not clear. 

In we construct and investigate a number of different QHS algorithms on 
free groups that arise from the application of various additional conditions imposed 
upon the minimal 2-sided Schreier transversal requirement. In this section, we only 
give a descriptive sketch of the simplest of these algorithms, i.e., a QHS algorithm on 
free groups with only the minimal 2-sided Schreier transversal requirement imposed. 

Let F = F (x\, %2, ■ ■ ■ j %n) be the free group of finite rank n with free basis 
X = {xi,X2, ■ ■ ■ , x n }, and let ip : F — ► S be an HSP on the free group F. We 
assume that the hidden subgroup K is normal and of finite index in F. (Please 
note that K — Ker ((p) = p^ 1 p (1) .) 

• Choose a finite group probe G with presentation [x\, X2, ■ ■ ■ , x n : n, Ti, ■ ■ ■ , r m ) 
where the subscript v denotes the epimorphism v : F — > G induced by the 
map Xj i — > xjCons (r2, ■ ■ ■ , r m ). 

• Choose a minimal 2-sided Schreier transversal r : G — > F of the epimor- 
phism v : F — > G. 
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• Finally, construct the push 

tp = Push (tp) = p o t : G — ► S 



Our generalized Shor algorithm for the free group F consists of the following 
steps: 

Step 1. Call QRand(^) to produce a word s'j in F close to a word Sj lying in 
Step 2. With input s'j, use a polytime classical algorithm to determine Sj. (See 

EDO 

Step 3. Repeat Steps 1 and 2 until enough relators s/s are found to produce a 
presentation 

(X1,X2, ■ ■ ■ ,X n ■ Si, S2, ■ ■ ■ , Si) 

of the hidden subgroup F/K, then output the presentation (x\, x%, . . . ,x n : s± 
and Stop. 

Obviously, much more needs to be said. For, example, we have not explained 
how one chooses the relators rj so that G = (x±, x%, . . . , x n : r±, r%, . . . , r m ) is a 
good group probe. Moreover, we have not explained what classical algorithm is 
used to transform the words s'j into the relators Sj. For more details, we refer the 
reader to |5T] . 



13. IS GROVER'S ALGORITHM A QHS ALGORITHM? 



In this section, our objective is to factor Grover's algorithm into the QHS prim- 
itives developed in the previous sections of this paper. As a result, we will show 
that Grover's algorithm is more closely related to Shor's algorithm than one might 
at first expect. In particular, we will show that Grover's algorithm is a QHS al- 
gorithm in the sense that it solves an HSP (p : Sn — > S, which we will refer to as 
the Grover HSP. However, we will then show that the standard QHS algorithm 
for this HSP cannot possibly find a solution. 

We begin with a question: 

Does Grover's algorithm have symmetries that we can exploit? 

The problem solved by Grover's algorithm |24|. |12j . [T3"] is that of finding 
an unknown integer label jo in an unstructured database with items labeled by the 
integers: 



given the oracle 



0,1,2,.. .,j 0) ...,iV-l = 2"-l , 

f(i) = ( 1 if J=J0 

v ' otherwise 
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Let H be the Hilbert space with ortho-normal basis |0) , |1) , |2) , . . . , \N — 1). 
Grover's oracle is essentially given by the unitary transformation 

7 bo) : n — > n 

\j) — (-i) /0) li) 

where 7u \ =1 — 2 \jo) ( Jo I is inversion in the hypcrplanc orthogonal to \j). Let 
W denote the Hadamard transformation on the Hilbert space H. Then Grover's 
algorithm is as follows: 

Step 0. (Initialization) 

IV>> — W\Q) = ^J£\j) 
fc < — 

Step 1. Loop until k w /4 

IV-) — Q|V)=-W/| >W7 bo) |V) 
fc < — fc + 1 
Step 2. Measure |i/>) with respect to the standard basis 

|0),|1),|2),...,|JV-1) 
to obtain the unknown state | jo) with 

Prob > 1 - — 
N 

But where is the hidden symmetry in Grover's algorithm? 

Let Sn be the symmetric group on the symbols 0, 1, 2, . . . , N— 1. Then Grover's 
algorithm is invariant under the hidden subgroup Stabj = {g e : g (jo) = jo} C 
5jy, called the stabilizer subgroup for j , i.e., Grover's algorithm is invariant un- 
der the group action 

Stab jo x H — ► H 

( \~^ N ^ 1 \ TT^N-l 

{9>2^ i=0 a ^) ^ Z^=o a ^ g[j)) 

Moreover, if we know the hidden subgroup Stabj , then we know jo, and vice 
versa. In other words, the problem of finding the unknown label jo is informationally 
the same as the problem of finding the hidden subgroup Stabj . 

Let (ij) £ Sn denote the permutation that interchanges integers i and j, and 
leaves all other integers fixed. Thus, (ij)is a transposition if i ^ j, and the identity 
permutation 1 if i = j. 

Proposition 4. The set {(Ojo) , (l?o) j (2jo) > • • • j ((N — 1) jo)} is a complete set of 
distinct coset representatives for the hidden subgroup Stabj of Sn, i-e-, the coset 
space Sn / Stabj a is given by the following complete set of distinct cosets: 

S N /Stab jo = {(0j ) Stab jo , (lj ) Stab jo , (2j Q ) Stab jo , ...,((N-1) j Q ) Stab jo } 
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We can now see that Grover's algorithm is a hidden subgroup algorithm in the 
sense that it is a quantum algorithm which solves the following hidden subgroup 
problem: 

Grover's Hidden Subgroup Problem. Let ip : Sn — > S be a map from 
the symmetric group Sn to a set S — {0, 1, 2, . . . , N — 1} with hidden subgroup 
structure given by the commutative diagram 

Sn — > S 
Sn I Stabj 

where Vj : Sn — ► Sn / Stabj is the natural surjection of Sn on to the coset space 
Sn I Stabj , and where 

l: SN/Stabj — ► S 
Wo) Stab jo i — ► j 
is the unknown relabeling (bijection) of the coset space Sn / Stabj onto the set S. 
Find the hidden subgroup Stabj with bounded probability of error. 

Now let us compare Shor's algorithm with Grover's. 

From section 6, we know that Shor's algorithm |23, |25|. |35| . solves the 
hidden subgroup problem <p : Z — > 7Ln with hidden subgroup structure 

£i > £/N 

Moreover, as stated in section 6, Shor has created his algorithm by pushing 1 the 
above hidden subgroup problem ip : Z — > In to the hidden subgroup problem 
ip : Tiq — > In (called Shor's oracle), where the hidden subgroup structure of <p> is 
given by the commutative diagram 

Z — > Z N 
a \\ t / <p = ipor , 

Z Q 

where a is the natural epimorphism of Z onto Zq, and where r is Shor's chosen 
transversal for the epimorphism a. 

Surprisingly, Grover's algorithm, viewed as an algorithm that solves the Grover 
hidden subgroup problem, is very similar to Shor's algorithm. 

Like Shor's algorithm, Grover's algorithm solves a hidden subgroup problem, i.e., 
the Grover hidden subgroup problem tp : Sn — ► S with hidden subgroup structure 

Sn — ► S 
v\ /i , 

Sn /Stabjo 

where S = {0, 1, 2, . . . , N — 1} denotes the set resulting from an unknown relabeling 
(bijection) 

Wo) Stab jo i — > j 

^See Section II. A. 6 for a definition of pushing. 
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of the coset space 

S N /Stab jo = {(0j ) Stab jo ,(ljo) Stab jo , (2j ) Stab jo , ...,((N- I) jo) Stab jo } . 

Also, like Shor's algorithm, we can think of Grover's algorithm as one created 
by pushing the Grover hidden subgroup problem tp : Sn — ► S to the hidden 
subgroup problem tp : SN/Stabj — > S, where the pushing is defined by the 
following commutative diagram 

Sn — > S = Sn / Stabj 

a \\ r / tp — (p O T , 

SN/Stab 

where a : Sn — > SN/Stabo denotes the natural surjection of Sn onto the coset 
space SN/Stabo, and where r : SN/Stabo — ► SVdenotes the transversal of a given 

by 

SN/Stabo — ► Sn 
(jO)Stab a ^ (jO) ' 



Again also like Shor's algorithm, the map (p given by 

SN/Stabo — ► Sn /Stabj = S 
(jO) Stab Q h-> (jjo) Stab Ja = j 

is (if jo 7^ 0) actually a disguised Grover's oracle. For the map yp can easily be 
shown to simply to 

{ ~ l^t, 

which is informationally the same as Grover's oracle 

f(i) = l 3 if 3 =j ° 
yj ' 1 otherwise 



Hence, we can conclude that Grover's algorithm is a quantum algorithm very 
much like Shor's algorithm, in that it is a quantum algorithm that solves the Grover 
hidden subgroup problem. 

However, . . . , this appears to be where the similarity between Grover's and Shor's 
algorithms ends. For the standard non-abelian QHS algorithm for Sn cannot find 
the hidden subgroup Stabj for each of following two reasons: 

• Since the subgroups Stabj are not normal subgroups of Sn, it follows from 
the work of Hallgren et al JS| i [III that the standard non-abelian hidden 
subgroup algorithm will find the largest normal subgroup of Sn lying in 
Stabj . But unfortunately, the largest normal subgroup of S n lying in 
Stabj is the trivial subgroup of Sn- 

• The subgroups Stabo, Stabi, . . . , StabN-i are mutually conjugate subgroups 
of Sn- Moreover, one can not hope to use this QHS approach to Grover's 
algorithm to find a faster quantum algorithm. For Zalka |4()j has shown 
that Grover's algorithm is optimal. 
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The arguments given above suggest that Graver's and Shor's algorithms are more 
closely related that one might at first expect. Although the standard non-abelian 
QHS algorithm on Sjv can not solve the Grover hidden subgroup problem, there 
does remain an intriguing question: 

Question. Is there some modification of (or extension of) the standard QHS al- 
gorithm on the symmetric group Sn that actually solves Grover 's hidden subgroup 
problem? 

For a more in-depth discussion of the results found in this section, we refer the 
reader to |5U], 

14. Beyond QHS algorithms: The suggestions of a meta-scheme for 

CREATING NEW QUANTUM ALGORITHMS 

In this paper, we have decomposed Shor's quantum factoring algorithm into 
primitives, generalized these primitives, and then reassembled them into a wealth 
of new QHS algorithms. But as the results found in the previous section suggest, 
this list of quantum algorithmic primitives is far from complete. This is expressed 
by the following question: 

Where can we find more algorithmic primitives to create a more well rounded 
toolkit for quantum algorithmic development? 

The previous section suggests that indeed all quantum algorithms may well be 
hidden subgroup algorithms in the sense that they all find hidden symmetries, i.e., 
hidden subgroups. This is suggestive of the following meta-procedure for quantum 
algorithm development: 

Meta-Step 1. Explicitly state the problem to be solved. 

Meta-Step 2. Rephrase the problem as a hidden symmetry problem. 

Meta-Step 3. Create a quantum algorithm to find the hidden symmetry. 

Can this meta-procedure be made more explicit? 
Perhaps some reader to this paper will be able to answer this question. 
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